Securing block storage
Block storage is a storage scheme such as the on-premises storage area network (SAN).
It allows you to mount a volume (disk), format it to a common filesystem (such as NTFS for Windows or Ext4 for Linux), and store various files, databases, or entire operating systems.
In the following diagram, we can see how a VM is mounting block storage directly from within the operating system:
Figure 5.2 – Attaching block storage
General best practices for securing block storage
Regardless of the cloud provider you are using when using block storage, you should follow these best practices:
- Use IAM services to control who can attach, detach, or create a snapshot for block storage volumes to minimize the risk of data exfiltration
- Enforce encryption at rest on all block storage volumes and snapshots during creation to maintain data confidentiality
- Use ACLs to define who can access specific volumes and what actions...
